Appl, No. 10/076,441 

Reply to Office action of November 16, 2005 

Amendments to the Claims; 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

Listing of Claims: 

1 . (Currently Amended) A method of detecting a computer malware comprising the 
steps of: 

joining an Internet Relay Chat server; 

retrieving a list of chaimels of the Intemet Relay Chat server; 

monitoring at least one channel in the list of retrieved channels, by: 

joining a channel, 

waiting a time delay, 

leaving the channel, and 

simulating user activities by transmitting a message to the channel; 
accepting data received from the monitored channel; 
storing and logging the data received from the monitored chaimel; and 
scanning the received data to detect a computer malware; 

wherein an Intemet Relay Chat client is utilized in the joining, the retrieving, and the 
monitoring; 

wherein the Intemet Relav Chat chent scans the received data to detect the computer 
malware and collects statistics including a receipt time of the data and a sender of the data . 

2. -5. (Cancelled) 

6. (Previously Presented) The method of claim 1 , wherein the computer malware 
comprises at least one of a computer virus, a computer worm, or a computer Trojan horse 
program. 

7. (Previously Presented) The method of claim 1 , ftirther comprising the step of: 
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analyzing the stored and logged data to detect the computer malware. 

8. (Original) The method of claim 7, wherein the computer malware comprises at least 
one of a computer virus, a computer worm, or a computer Trojan horse program. 

9. - 14. (Cancelled) 

1 5 . (Currently Amended) A system for detecting a computer malware comprising: 
a processor operable to execute computer program instructions; 

a memory operable to store computer program instructions executable by the 
processor; and 

computer program instructions stored in the memory and executable to perform 
the steps of: 

joining an Intemet Relay Chat server; 

retrieving a list of channels of the Intemet Relay Chat server; 

monitoring at least one channel in the list of retrieved channels, by: 

joining a channel, 

waiting a time delay, 

leaving the channel, and 

simulating user activities by transmitting a message to the channel, 
accepting data received from the monitored channel; 
storing and logging the data received from the monitored channel; and 
scanning the received data to detect a computer malware; 

wherein an Intemet Relay Chat client is utilized in the joining, the retrieving, and the 
monitoring; 

wherein the Intemet Relav Chat client scans the received data to detect the computer 
malware and collects statistics including a receipt time of the data and a sender of the data . 

16. -19.(Cancelled) 
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20. (Previously Presented) The system of claim 15, wherein the computer malware 
comprises at least one of a computer virus, a computer worm, or a computer Trojan horse 
program. 

2 1 . (Previously Presented) The system of claim 1 5, further comprising the step of: 
analyzing the stored and logged data to detect the computer malware. 

22. (Original) The system of claim 2 1 , wherein the computer malware comprises at least 
one of a computer vims, a computer worm, or a computer Trojan horse program. 

23. - 28. (Cancelled) 

29. (Currently Amended) A computer program product embodied on a computer 
readable medium for detecting a computer malware comprising: 

computer program instructions, recorded on the computer readable medium, 
executable by a processor, for performing the steps of 
joining an Internet Relay Chat server; 
retrieving a list of channels of the Internet Relay Chat server; 
monitoring at least one channel in the Ust of retrieved channels, by: 
joining a channel, 
waiting a time delay, 
leaving the channel, and 

simulating user activities by transmitting a message to the chaimel; 
accepting data received from the monitored channel; 
storing and logging the data received from the monitored channel; and 
scanning the received data to detect a computer malw2u:e; 

wherein an Internet Relav Chat client is utilized in the joining, the retrieving, and the 
monitoring: 

wherein the Internet Relav Chat client scans the received data to detect the computer 

malware and collects statistics including a receipt time of the data and a sender of the data . 
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30. - 33. (Cancelled) 

34. (Previously Presented) The computer program product of claim 29, wherein the 
computer malware comprises at least one of a computer virus, a computer worm, or a 
computer Trojan horse program. 

35. (Previously Presented) The computer program product of claim 29, further 
comprising the step of: 

analyzing the stored and logged data to detect the computer malware. 

36. (Original) The computer program product of claim 35, wherein the computer 
malware comprises at least one of a computer virus, a computer worm, or a computer Trojan 
horse program. 

37. -57. (Cancelled) 

58. (Previously Presented) The method of claim 1, wherein transmitting the message to 
the channel is utilized for triggering the computer malware in the channel to be sent. 

59. (Currently Amended) The method of claim 1 , wherein the storing and logging 
includes storing and logging [a]the receipt time of the data and [a]the sender of the data. 

60. (Cancelled) 

61 . (Currently Amended) The method of claim [60] 1, wherein the Internet Relay Chat 
client automatically accepts and stores the data received from the monitored channel. 

62. (Cancelled) 

63. (Cancelled) 
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64. (Currently Amended) The method of claim [63]i, wherein the Intemet Relay Chat 
client notifies an administrator of the computer malware. 

65 . (Previously Presented) The method of claim 1 , wherein the received data includes 
direct cUent-to-client DCC send requests. 

66. (Previously Presented) The method of claim 7, wherein the analyzing is 
automatically performed. 

67. (Previously Presented) The method of claim 7, wherein the analyzing is performed 
manually. 

68. (New) The method of claim 1, wherein the monitoring is performed utilizing a 
restricted and secure scripting language. 

69. (New) The method of claim 1 , wherein a plurality of Intemet Relay Chat cUents 
running on a single computer are each utilized in the joining, the retrieving, and the 
monitoring. 
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